Allow detecting a ROLIE update efficiently

[ctron]

Currently, to my understanding of the spec, the ROLIE feed documents grow with each added CSAF document. Assuming a larger quantity of documents, this can lead to a signification size of those ROLIE JSON documents.

However, in order to understand/detect if a ROLIE feed contains new data, it is required to load the full file, and evaluate the contained .feed.updated field.

This may lead to a signification amount of traffic, just for detecting a change in the file (a need to update).

I think it would make sense to extract this information, and make it cheaper to detect if a ROLIE file needs to be re-processed.

To my understanding there is a "ROLIE service document", however this seems to be defined by RFC8322, which defines the service document itself in RFC5023 … and unfortunately does not contain such information. However, the RFC also seems to indicate that "extensions" are possible on the level of a collection entry.

My proposal would be to add a field (e.g. named updated), which carries the field of the .feed.updated field of the ROLIE JSON feed document. Adding a requirement, that when a "service document" is used, this field must be in sync between the service document collections entries and the actual ROLIE feed document.

[tschmidtb51]

@ctron The comments mailing list is now back online. Please formally announce your suggestion there, e.g. through "Please see our suggest in Github Issue XYZ (https://github.com/oasis-tcs/csaf/issues/XYZ)."

[tschmidtb51]

This has been suggested on the comment mailing.

[sthagen]

During the 2024-12-18 TC meeting Thomas Schmidt moved to accept the proposal, seconded by Martin Prpic, no discussion, no objections, the motion carries.